Post-intrusion tactics relate to those techniques used by an adversary following the initial intrusion and prior to the final objective.
These activities can be thought of as those which help position the attacker to carry out the final stage of an attack whilst remaining undetected.
In the context of APTs, this is inclusive of activities to help the attacker establish a foothold, evade defences, remain persistent, and move laterally to the target within the network.
The use of virtualisation and container technology for the orchestration of NFs within the 5GCN introduce the possibility of image files being implanted within the system as to introduce a malicious NF [1]},[2]}.
This type of technique could arise directly as a result of a supply chain compromise or be facilitated by a malicious insider.
This type of technique serves as a form of Persistence and Defence evasion tactic.
The use of virtualised components which reside on the same physical infrastructure also introduces the risk of VM/container breakout, allowing an attacker to move laterally if there exists vulnerabilities in the hypervisor software or mis-configurations such as poor isolation of virtual machines and containers.
